{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"MetaDefender Endpoint Security SDK","source":"CNA: palo_alto","vendor":"OPSWAT","versions":[{"changes":[{"at":"4.3.4822","status":"unaffected"}],"lessThan":"4.3.4822","status":"affected","version":"4.3.0","versionType":"custom"}]}],"cveId":"CVE-2026-0324","cwes":["CWE-266"],"description":"An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\\SYSTEM.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: palo_alto","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber","version":"4.0"}],"modifiedAt":1794427353834,"publishedAt":1794427353834,"references":[{"source":"CNA: palo_alto","tags":["third-party-advisory"],"url":"https://security.paloaltonetworks.com/CVE-2026-0324"}],"remediation":[{"kind":"fix","source":"CNA: palo_alto","text":"This issue is fixed in MetaDefender Endpoint Security SDK 4.3.4822 on Windows, and all later MetaDefender Endpoint Security SDK versions on Windows. To mitigate this issue in the GlobalProtect App on Windows update to one of the listed versions (these versions include the updated MetaDefender Endpoint Security SDK):\n\n\nVERSION                             MINOR VERSION            SUGGESTED SOLUTION\nGlobalProtect App 6.3 on Windows   6.3.0 through 6.3.3-h2    Upgrade to 6.3.3-h3 (6.3.3-711) or later.\nGlobalProtect App 6.2 on Windows   6.2.0 through 6.2.8-h3    Upgrade to 6.2.8-h4 (6.2.8-317) or later.\nGlobalProtect App on macOS                                   No action needed.\nGlobalProtect App on Linux                                   No action needed.\nGlobalProtect App on iOS                                     No action needed.\nGlobalProtect App on Android                                 No action needed.\nGlobalProtect UWP App                                        No action needed."},{"kind":"workaround","source":"CNA: palo_alto","text":"No known workarounds or mitigations exist for this issue."}],"revision":"9276c15a2afefab20742537bf969a8f8575395ad56b9dc62234e61282c071cfd","sources":[{"modifiedAt":1794427353834,"name":"CNA: palo_alto","retrievedAt":1794431303334,"url":"https://www.cve.org/CVERecord?id=CVE-2026-0324"}],"ssvc":null,"status":"published","title":"GlobalProtect App: Incorrect Privilege Management Vulnerability in OPSWAT MetaDefender Endpoint Security SDK on Windows","updatedAt":1794431303334}